From 3d72c2f20c736214c103226641d1d9dfe9326c74 Mon Sep 17 00:00:00 2001 From: FumingPower3925 Date: Wed, 17 Jun 2026 16:43:42 +0200 Subject: [PATCH 1/2] Update the bundled Scalar UI to 1.60.0 (#100) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot flagged @scalar/api-reference 1.60.0. It is an additive minor — a content.start plugin slot and an opt-in sidebar for plugin views, plus a handful of rendering fixes (composition nesting, deep links into collapsed schemas, response descriptions, the loading skeleton, a 1000px sidebar overlap). None of it touches the standalone build or the #api-reference/data-url bootstrap both UIs rely on, so no page or CSP change is needed. The version is pinned in several places that have to move together or the parity tests fail: the package.json tracker, the CDN version and sha384 SRI in ui/scalar, and the vendored bundle, version, and go:generate URL in ui/scalaremb, plus both pinning tests. The new standalone.js is byte-identical between the npm tarball and the pinned jsDelivr URL, and the SRI is recomputed from those bytes. --- package.json | 2 +- ui/scalar/scalar.go | 6 +- ui/scalar/scalar_pinning_test.go | 4 +- ui/scalaremb/assets/standalone.js | 497 +++++++++++++------------ ui/scalaremb/scalaremb.go | 6 +- ui/scalaremb/scalaremb_pinning_test.go | 4 +- 6 files changed, 260 insertions(+), 259 deletions(-) diff --git a/package.json b/package.json index dd99aa5..fafbdc4 100644 --- a/package.json +++ b/package.json @@ -4,7 +4,7 @@ "private": true, "description": "Dev-only manifest. Used by Dependabot to track upstream versions of the docs UI bundles and the typescript release CI type-checks tsgen output against; the Go source in ui/*/*.go is the source of truth for the bundle versions that ship. Do not 'npm install' — the runtime does not import any npm package.", "devDependencies": { - "@scalar/api-reference": "1.59.3", + "@scalar/api-reference": "1.60.0", "@stoplight/elements": "9.0.22", "redoc": "2.5.3", "swagger-ui-dist": "5.32.6", diff --git a/ui/scalar/scalar.go b/ui/scalar/scalar.go index 6f154bb..f180659 100644 --- a/ui/scalar/scalar.go +++ b/ui/scalar/scalar.go @@ -17,7 +17,7 @@ // Scalar JavaScript and CSS are loaded from cdn.jsdelivr.net at page // load time, so an internet connection is required. // -// The CDN URL is pinned to a specific version (1.59.3) and points at +// The CDN URL is pinned to a specific version (1.60.0) and points at // the verbatim dist/browser/standalone.js file from the npm package, // so its bytes are deterministic and the sha384 SRI hash below is // pinned in the